Most fraudulent hires receive corporate credentials and internal network access before being detected, according to a new report by HYPR.
Fraudulent candidates successfully navigate pre-hire screening and take up their roles in 42% cases. Just 3% are subsequently detected as fraudulent on the same day as they are officially hired.
Around a third (32%) are discovered within one to three days, 45% within four to six days and 20% go undetected for up to three weeks. This means that fraudulent hires have an average of 5.73 days of unmonitored access to corporate networks, posing significant data security risks to organizations.
Almost all (98%) of 500 US HR executives who were surveyed as part of the study said they had experienced candidate fraud first hand, while 89% expressed heightened concern over hiring fraud in the past two years.
Bojan Simic, CEO and co-founder of HYPR, warned: “Adversaries no longer need to breach a network when they can pass a remote interview and receive authentic credentials directly from IT.”
Among the fraudulent candidates that are detected during the hiring process, 68% are identified by human instinct.
Screening (52%) and interviews (45%) are the most common pre-hire detection points, followed by technical assessments (41%) and onboarding (42%).
“A process that catches fraud at every different stage isn’t really a security funnel – it’s a set of disconnected checks operating in silos. Because no single stage reliably stops candidate fraud, clearing an earlier stage offers no guarantee of identity assurance,” HYPR wrote in the study dated September 15.
The report also highlighted a significant discrepancy between who is responsible for identifying candidate fraud pre hire. About half (53%) of HR executives surveyed took ownership for hiring identity risk before an offer is accepted, while 19% said the talent acquisition team is responsible, 10% for compliance/legal, 10% security and 7% IT.
HYPR said this suggests that many organizations operate with the assumption that IT and security only take responsibility for candidate identity risk post hire.
Hiring Fraud Creates Significant Insider Risk
The report findings, published on September 15, come amid National Insider Threat Awareness Month 2026.
On September 9, the US Cybersecurity and Infrastructure Security Agency (CISA) released an update to its Insider Threat Mitigation Guide, which highlighted how malicious actors are using various AI tools to assist them in applying for and obtaining remote IT jobs to gain privileged access into enterprises.
This has been a tactic extensively used by North Korean actors to gain employment in Western firms in recent years for purposes such as data theft and even subsequent extortion.
Despite these publicized threats, the HYPR report found that around 60% of identity verification and multi-factor authentication budgets are only authorized reactively following a security breach.
